Email request to "borrow" my github account for 10 minutes

[leres]

I received a request via email (sent to an address only known to github!) to "borrow" my account in exchange for 1200 yuan. This seemed worth reporting (in a timely manner) but after poking at it for more than an hour I can't figure out how to do it. Perhaps interested parties could reach out to me?

[Akash1134]

Hi @leres , 👋🏻 We really appreciate you flagging this. The best route to get this to the proper GitHub team is to use our abuse reporting tools. Here's all the info:

• Reporting abuse or spam
• Reporting a user
• Reporting an issue or pull request
• Reporting a comment

You can report behavior and content that violates community guidelines and terms. We are going to close this post, but for this and any future incidents, please refer to the links above.

Thank you!

[leon-barrett]

I got a similar email, and I couldn't find how to use any of those reporting tools to report an email about GitHub that I got from an unrelated email address.

This is a different sort of abuse than those documents address. They show how to deal with abuse that I'm receiving on GitHub, but not how to warn GitHub that people are trying to abuse the service itself.

[leres]

Exactly! I had already found and discarded the links in @Akash1134's post.

[ThomasWaldmann]

Also got that email. Did they spam / try to scam everybody?

"""
Dear friend，

I am a Chinese developer live in Chengdu, your github account has received the Starknet airdrop. If you are familiar with the operation, you can collect it yourself and exchange it for cash. If you are not familiar with the relevant operation, I can directly give you 1,200 yuan in cash or 180 US dollars via paypal/alipay and use your account for 10 minutes.
I run a mining pool and am familiar with the gameplay of the crypto circle. ...
"""

[angry-mustard-it]

Apparently, that came from a ElsaGate-like phenomenon about Chinese, Indian and Vietnam sellers/bitcoin miners/scams.

ElsaGate created account hackings on YouTube and seizure-inducing content that is not appropriate on YouTube (gore, graphic imagery, car crashes, all on YouTube Shorts)

[leres]

A friend found info that likely explains the attack:

https://therecord.media/github-investigating-crypto-mining-campaign-abusing-its-server-infrastructure

The attack involves forking a legitimate repository, adding malicious GitHub Actions to the original code, and then filing a Pull Request with the original repository in order to merge the code back into the original.

But the attack doesn't rely on the original project owner approving the malicious Pull Request. Just filing the Pull Request is enough for the attack, Perdok said.

The Dutch security engineer told us attackers specifically target GitHub project owners that have automated workflows that test incoming pull requests via automated jobs.

(Too bad that so far github doesn't have a method for us to report attempts...)

[ThomasWaldmann]

Guess that's why you have to approve PRs from new contributors before it'll run the actions.